Linux Kernel Use-After-Free Vulnerability (CVE-2023-0266)

An attacker, with a low-privilege account, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2023-04-20 under CISA BOD 22-01.

This is a Use After Free (CWE-416) vulnerability in Linux Kernel. A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e Exploitation requires adjacent_network access, higher attack complexity, a low-privilege authenticated account, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2023-03-30 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2023-04-20.